SmartCited is an early-stage product. This page lists how the service actually handles your data today. It is not a certification: we have no SOC 2, ISO 27001, or similar audit yet.
Where your data lives
- Database and sign-in: Supabase (Postgres and Supabase Auth).
- Scan servers: Fly.io, in the San Jose (US West) region.
- Website hosting: Vercel.
- Payments: Stripe. Card details are entered on Stripe's checkout page and never reach our servers.
Access control
- Every request to our API carries your sign-in token, and the server verifies its signature against Supabase's published keys before doing anything.
- Every query for your scans, reports, and tasks is limited to your own account ID, so one customer can't read another's data.
- Database keys with full access live only in server environment settings, never in the website code or in our source repository.
- All traffic to smartcited.com and our API is served over HTTPS.
What we send to AI engines
To run a scan we send the website URL you submit and the buyer questions derived from it to the AI engines and model providers listed in the Privacy Policy. Your name, email address, and account details are not sent.
Abuse protection
New scans are rate-limited per hour, and free accounts have a scan quota.
Reporting a security issue
If you find a vulnerability, email contact@smartcited.com with the details. Please give us a chance to fix it before sharing it publicly.